Fast-track your Cybersecurity/Hacking Career

the second day besides Dell my name is Joe Klein if you're here for anything besides fast tracking your happiness I was here the career watching slow road so I'm part of the community for years I've been mentoring and helping others get through this particular process mostly because I've played everything from a firewall guy to who achieve security officer several times chief information you know I basically played our roles and I've basically been doing this and give back to the community so others can get into this career successfully and grow into whatever you want to do okay so yes I'm affiliated with mitre corporation and this is my position this is my opinion this is my

employment so this look that first thing we're going to talk about is understanding the job process a lot of people tell you that I play both sides of this process and disturbs me using it so this will simplify the process of coming on board and be able to create relationship and set yourself up to really succeed we'll talk about ways to think about how to manage your career from the time you get a job you want to basically leave the jobs into a career something that you can go to some goal that you can say I want to be them someday or also now there are places that you can't find Cyrus appear to jump reserved places you

can find a lot of jobs but it's based on a role of what you want to become and where you are today so you can find the best places importance of mentorship and then a bunch of resources which I'm going to take some time you go through these resources because I think that they're so critical nobody puts them in the same place so cybersecurity so you have so you have an organization over here and I'm somebody with a job title this job title maybe the manager that you're gonna report to this may be an HR person it may be some VP that has no idea of what your activity is going to be what you're tasked what you're going

to be performing is going to be so that's bent over here that's why some job titles you you basically have job experience education training certification and special so on their side they have to define the responsibilities for a job they're looking for they have a set of expectations and they're trying to meet up those expectations sometimes those expectations are pretty outrageous so does a my right go the go programming language the pro-growth the go programming language has only been around six years for those that are interested most people just started recently I have seen resumes or job requests to say I want somebody with 10 years of gold experience okay this is the kind of

expectations that these guys have we have to understand and help bring in what they need second thing is they're looking for two types of jobs for you and you want to position yourself as the strategic not active tactical many times is there hoping that you're the cog that fits into this machine and okay but you want as you want strategic strategic will give you they have future plans for you then you're hired on to do this project for the next year six months two years but they have a plan for you to actually drive you and help you succeed your career not just the job when you're going to get a resume which I hope you

have one you've had a professional word friend and cybersecurity review and help polish I saw one no right there okay so there's a there's a process you also want to have a bunch of interview questions why coming from the side we're on the hiring manager and I'm asking all the questions and I'm just about to say so do you have any questions and I get it doesn't work okay have some questions engage we talk about how to frame that particular right so this is what this is the gap we're trying to get past so the job manager again we talked we spoke that this may or may not have any idea what this role is especially if it's cold

they may not have any idea how to frame your role if it's an existing role they'll typically take the other person's resume and oh yo yo yo that's it that's it okay so there's again there's some expectations that don't work so what they'll do is they'll break down two tasks because they're hiring to accomplish specific things I want you to manage the firewall on a successful way make sure it's logged I want you to look at the IDS when you're doing fantastic I want you to win every single time you do a pen test whatever that may be and then by the way rate the report so they're going to find this based on tasks so

this will take some time again a lot of times they don't have the experience on how framework we're talk about that because actually hiring they can help you through this process to help you know fill those they tasks from a strategic and tactical standpoint tasks can be learned in from a notate T standpoint in less than 90 days if you click with the individual and you identify what those are you can actually say look I don't know that today but with some help like to do this in 90 days or right now before you start doing the job hunting maybe you're in school may you consider picking up some of the classes and some of the actual

techniques you should only go to a for 90 days a few hours a week maybe lots hours with me what you gotta get off the Xbox for a while so recognize this becomes real important the more of these you have and by the way you know one of these are that a lot of people see as their strategic when you're here we have a lot of people that want to be in the cybersecurity business but if you guys are you anyway but it's it's real important you include that on your resume that you're attending community events via meetups on a monthly basis whatever it is next thing is the hard part for them they don't

have to figure out for each task based on usually somebody else's resume or some general idea they have what's the knowledge skill and ability that you need to accomplish these tasks and as you can see that there are some abilities across everything there's some abilities that only only support one tax okay and what they typically do or should is create questionnaire to help them understand where you fit here a lot of times people will fake this also based on your time you spend here and here you have the ability here to start discussing so if you guys have bonuses or retraining the support additional training what is your training process and I go to conferences you know what is

that and the candidates need to will have other things that you can't learn in 90 days if you're in town and sophomore freshman and junior this might be a chance for you to spend the time and get some of those longer-term techniques and learning behind you so the next thing haha once you go through this whole process recognize better make sure that your training certifications past employment everything is straight it saves the process this is the process that these guys gave it takes forever because I have to send it through a background check of some sort I have to do they have to send it through other people to validate this can take a week by two

weeks depending on some times a month ok so if you have all this straight it simplifies the whole process so the goal really is sorry the goal really is to fill this gap okay straightforward anybody ever seen anything like this this is really what we see on both sides and this is one of the problems from the cycle times business and trying to hire this is the one of the cycle time improvements you look at is how now if you are like recruiting okay for recruiting there is a document to a tool that's free that will allow you to help fill in the tasks and knowledge simplify this process okay it was created by lots of different

people and update multiple times there we go so the big check boxes for your homework match the job with the experience figure out if that experience and the job can be done in 90 days where it's going to take a lot longer what does that mean is sit down you look at some YouTube videos you do some reading you figure out how much you set realistic expectations on how you fit into that particular job it also perhaps you for now includes education training and certifications we have a panel discussion after this on discussing some ideas around here but I won't go into that set of special circumstances how many of you have a professional blog okay you should have a

professional blog it should include I went to be sides and here's some notes so I took at these sides they're important but be songs here's a conference that I went to here's a book that I read and here's my it doesn't have to be long it can be 115 500 words it can be a reference to some other persons materials okay keep the Fred professional blog next thing Lucas LinkedIn take that blog entry cut and paste it to LinkedIn so people that are looking for people like you will see it on LinkedIn click on and actually start discussions does anybody brake software and how to get say my brakes offer okay you have a github repository

yeah how to get your club repository that's again an important part anybody that doesn't brake software or lots of you okay take documents that you created that can be open to the public and put those documents on get up get up not just for software it's also for documents matter of fact if you look around you'll see people that post their standards documents up there to get opinions from other folks okay get yourself and get home these are free okay twitter twitter now okay this is this is the twitter handle not you had when you were a kid or teenager or maybe in college this is your professional twitter by the way please make sure you

also have a professional Facebook that other one has to go away professional email like teensy-weensy crazy drinking guy you know that's not a real good email address to have that's funny okay so please have a professional email address this this simplifies this whole process okay did you attend any security groups and conferences so which ones and where how often you can be presenters you know have that information with you can you volunteer so how many people have volunteer or done internship okay volunteer okay volunteer at a security conference why because you get to meet the most amazing people you get to meet the speakers you get to sickness need to speak your presentations and ask them

questions so you get to go have lunch or dinner or breakfast with them to ask ask questions oh okay this community is very giving we want more people in this community we want amazing people to help us solve it from a big big big tall okay so please attend those let's see volunteer also how many people have a home lab how many people and I have links to this for exercises you can use to become better in forensics networking system admin all the other basic features that it costs you nothing you just have to spend the time to go through the process okay and in recommendation for friends we have it again we're a pretty open

community we're trying to bring people in talk to people at the at this community and say hey I'm looking for position this is what I'm looking for very few people turn you down okay maybe they'll require so about the company we must think called open source intelligence this has they might heard of it okay guess what you get to get really good at this because you want to know about the company what do they sell what do they do they do services do they any product what other products are there big products little products who's their customer when you walk in and you know the person you're sitting across from about what their business is

they're far more excited than saying I'm a security guy and I'm here to help you okay versus hey I understand you can transportation you have these kind of threats based on maybe trucking or whatever can you talk to me about that so I understand what your environment is it becomes the two-way discussion and discussion changes to go I'm fine with the industry size locations locations are important if you want to live someplace else they may have their data center and aspirin Virginia versus here or they may have their it may give you a chance to work at home in some cases so those kind of things read their blogs what's important to their management right now what's their goal what's their

vision newsfeeds before you go in for two or three days watch their news maybe same can bring that up as a conversation piece just start the conversation so what is it about well also for companies if you know someone they are great if you don't ask the community I bet you somebody will know somebody that works in security at that content okay only makes sense we're a big community I mean our our big get-together is you know thirty approximately thirty thousand in here best friends called that okay so there's a lot of really good people plus in this area you have lots of these sides and other events always thin about five hundred four hundred three hundred

months what technology do they use go take a look at their other job requests are they using Oracle are they using Microsoft are they using blanks are using AWS those are the skills that they're going to ask you for not only on the resume but everything else lastly what interview questions do you think they're going to ask based on all this knowledge yes Google actually they here's the 10 questions Google asks did anybody do that for the company you're going to work for or maybe the industry get a heads up this is a recon exercise and by the way both source intelligence in this community this is a skill set that will save you lots of

time and money and effort accomplishments ok so the job is something you simply earn money for a career is something to connect your employment opportunities together a job has a minimal impact on your future so you're just looking for a job that's a one-shot thing but with a career wise you experience a fuel wherever you want to go in your future so that's the graphical representation of my career ok yes I took a lot of experience right so I like then and I've worked for people like people that created robots for Disney I've done electronics I've programmed for just all kind of things that work for a banking company they does ATMs and States and all kind of

things like that and I've worked for medical companies I've worked for a walk salting the only company so work for government contractors who have gone through a whole plethora of crazy experiences with this each one of them have different expectations so my career was going to some school learning learning learning learning taking classes taking classes continuing certification continuously move and understand what's going on by the way how fast does knowledge about this technology change as a haploid certify every three okay think about that you know if you were a physician and the long moves on a regular basis that wouldn't make things really difficult wouldn't it okay this is why it's called the hardest career most intellectually challenging

career on earth right now okay you're the people can help

so let's talk about the meniscus National Institute of Standards and Technology out of the Department of Commerce takes information from the community not only the government community but community at large to determine when there's gaps in the problems one of the problems they identified was the ability for to educate workforce and the brain workforce in this particular career so they worked on something called the national initiative for cybersecurity education workforce framework just like any very good government document it has a really great things references or technology partners employers and things like that the more important part is take a look at the category of specialties work roles and everything else okay the recruiting stuff okay great

bring your eyes to is this right here can you see that okay we have many major roles when I started the job was something's matter with their computer or marinara then it became I think maybe something's really wrong with our computer could it be one of those curse and then it became hey I think somebody's attacking their application then it became wait a second our business applications being taken down it must be a security issue can you go fix that okay our career then career this domain we changed our relationship with the business people and with the people running the systems so these are the major two major titles again when I would started there was one

major title guy that fixes stuff okay now we have all these major categories if we go down a little bit further we've a breakout of each thing perception okay so for security provision error ready maybe a risk manager here's what your role is or oversight valuations or documentation validation does that make more sense to be able to go through something like this to figure out what matches you versus just going through a resumes so I would suggest taking some time looking through this yes you may have to have a lot of these your choice but this will help a lot and also recognize in the and most domains they say junior senior experts they use lots

of terms for this documentation here's a framework any federal business or any government business this will describe to them what happened okay back to the show so it is recognized is this we didn't have a standard lexicon there are some jobs that have 85 different names in the field that's pretty crazy we didn't have any critical analysis on where do people come from in this field the people that were most successful where did they start and also you know how about analysis so they basically created a framework to define this so that we have capable workforce you're the workforce workforce here are some of the ideas again the major categorizations look at us 33 specialties that's pretty amazing 52

work ropes okay and then within the corporate world there may be slight variations matter of fact if you're doing forensics you may be a forensics person that does computers you may be a friend's each person who does dead boxes or hard drives or phones or IOT devices that's actually in these major categories okay so the next thing to look at is looking for specialty areas appearing in digital forensics there you go leadership management project management creating education defense analysis right there risk management all that okay so let's try an experiment

okay so I have a leak the bottom that goes to this can anybody see this okay so can i okay okay so basically these categories analysis operating collecting an operating investigating whatever what's interesting you to you okay which category is important for you basically cyber defense analysis defensive structures support in response so here's a set of related classes or build here is the ability to remember we talked about the abilities from looking for here's the general abilities or no pain trace rel and it's lookup we're there okay how about your knowledge okay

[Music]

and just cycle through so this is what they call capabilities indicator I'm going to give you a capability indicator I prefer but what the capability in air is okay I'm how to do pain I know how to use the command line on painting you other two things I know how to use pain and I can look at Wireshark and see if there's any variations I can write pink okay that's the for loop that's the four levels that you need to consider when you're going through your understanding of any of these tasks rolls and they have their their own equivalent here is they like including that you must have a PhD and things like that because the

majority did this was our academics so not even playing just reality

so I'm going to suggest that go to this link do some research you may find out you have a lot of knowledge already because you've been doing on teeth okay kind of cool and then it gives you a gap on what you need so the big picture based on analysis of everybody that's in the field today and exited already these are the roles the major roles that people have and a lot of times they did that because maybe they were doing biological science of some sort and they had to learn how to do a database to do their to do their program so they had to learn how to be lighty and their database in any way and hey are like the

cybersecurity thing and they slipped into it for historians that how to do lots of searches and how to use analytics and had to go through that particular process so this is the majority of major roles that people start from here when here in the IT here's the next level the major roles the next level for mid-level and the advanced example of so say one of your systems engineer there's the optimal path through through your roles I like that service to me the consultant is match to nothing you are actually what I've been waiting for I left my phone to see how many people were picking on me and watching it I people at home so this is an

example you see system engineer Maps to please and say you want to become a pen tester so you probably want to become incident handling so you have an idea of what type of attacks are being performed you can learn about those attacks and death and then become a penetration tester and then go into security architecture as an example so that you can defend against these guys which by the way really upsets it when you use their techniques experience okay the other thing is you want to map to how many job openings for you my general tasks what else sound effects thank you also contact Amin job titles that you'll see in the commercial world education

top certification skill level requirements and old skills that you want to basically start picking up one okay so that warm list is consolidated into this particular love so somebody and networking say you do networking okay so networking 245 you want to go from here we go there's the optimal path for that down below starter security specialists average throughout the country here's how many jobs are available job openings right now here's the title should be looking for in maintenance we call or in one of the major categories of 17 categories its operations maintenance or prevention so you could actually fall within two of those major categories here's the make up of education certifications and other things you

definitely okay you see how you can use this to figure out and understand how to go through this process okay so anybody else any programmers

okay I knew you were going to say sorry security architect right here okay so from sabe security architect here's the things to get there here's the things to get there okay so cyber security architect basically one drive through either pentesting and when drive through these capabilities through fantastic and then there's your cyber security architect by the way your cyber security architect that the problem salary type number of job openings right now and all the other items is that beautiful okay so the other thing we can do is it's really cool that we have this list of all these jobs Carmen Sandiego problem where are the jobs so fortunately have an interactive okay so these are the states that have the

jobs except there's one little problem there are places in those states those jobs don't exist it's because a metro area that's actually the highest possibility of getting a job anyplace and they're come up here to there we go right now in your area that's a job that's basically how many openings I want to make note of this there are some decisions you'll make that you want to move someplace to get a really good job this area has a very large peer community so you can actually learn from peers and things like that in one of the places I used to live it was myself and for other people okay and we were the security guys but we

really didn't have a lot of interaction you know almost an auditor ones pen test or things like that this is an idea that of making that decision also what's the ratio of supplied workers that usually allows you the ability it's the average and within the region here's the titles that you'll say I'll take a look at this rattle this is a breakdown of how many things you want to do as an example say that you want to become investigator if you're new and trying to be an investigator in the middle of Wisconsin you may find one person or two persons but if you go to here you may say off the welfare if the 41 investigators

forensics people things like that that is open jobs those are opportunities for another match I want to mention is certifications red is the holders if you're going for CSP so it's a half step so you don't have to sit for this crazy certification that's extremely hard for a lot of people okay some of you guys get to go to boot camps things like that I had to read the 40-plus books because they didn't have those things in an outline an outline outline and stressed it so it's the test we used to be a five-hour test you sit down this big room full of people you have to drive

you know I got it all wrong so I spend another round looking through everything and I did well I passed but just like they do certifications you have to actually match what the customer wants [Music] see IPP this is yes there are there are more jobs that actually put that but this is only reflecting the ones that have those letters stand correct there's more than just reading this and saying oh okay let me go here you actually have to research some of this understand hey this is a privacy

I'm glad you say that I can assure you and look good so so recognize this is current state you're totally correct there's a future state of things I was at a conference just last week talking about how we going to protect connected cars how we're going to protect nana's how we can protect limbs that are computer controlled how you protect all this other technology so your Raynal target privacy is a big issue but recognize this at least into a baseline and something to work from

now if you're interviewing you're going to be asked specific questions questions are you would have knowledge of the last something like I know how things look for the unemployed class I took a class and I did a forensics of a file I had experience in I can teach a class from a bull because I spent the time to write the write and then you have the next category which is expertise which is I altered new material like author training I written a book or I've helped write RFC's and standards okay this is how the community needs to look at this stuff because not a lot of people also have different capabilities different areas I'm known for my bt6 expertise because

I've been working on for 18 years I'm working on a book can help do a lot of these things okay but there are some things I'm up here at okay so that's depending on each person what they're focused on okay geography yeah if opportunity doesn't knock build the door yes you will have to move you may have to fly through your work and you have to ask that question especially if you have a family or prepared having family or whatever I mean I've been on the road for a while at one point curve 300 a year it's really cool until the day that I woke up then I say my country my for you to

chase this down and spend the time put it on your calendar and do this Bundys a holiday put it on your calendar spend the time good I need more peers in my community please be my peers ok yes because a lot of people want to go today I just want to include this because I find the offset of all the certifications look at how few peers they are compared to here and look at how few expertise in each area they are from here so those areas of the country that you can be able to learn faster you're going to have bigger communities especially early in your career considering there to go to those later the career name want to move to

someplace else that has less people you know and the you fly someplace or have your company lived as an example this is an indicia you must have in the DC area you could go to one to two security events every day of the month sometimes three okay just that many people doorstep many events there's that many specialists so mentors mentor is a brain to pick and here to listen and push you in the right direction consider finding a mentor throughout your life throughout your career it's not your job because your jobs will pay people to mentor you or they get trouble because if their mentor in you which is a whole other interesting conversation these are the

major roles that I have found that are most successful and pushing people into this career and helping them succeed we take a look at the Challenger they're going to say you know if you spend a couple more hours there's a good chance that don't you let it figure this out I you know you can do that or hey I challenge you to get together presentation today so you can be a speaker okay you need somebody there that challenge cheerleader hey coach you know what is the big picture why you're doing this I bring you back to your career

if I go out to Josh I can say Josh I'm looking for somebody to us soma so do that okay fine connectors in your life they're fun because you ask different questions you may find it Wow I learn about this to happen to be at the conference and your connector will be able to introduce you and stitching down with that person and by the way it's not uncommon in these conferences to find a connector and you're sitting down across from the person that write wrote that code rode that exploit rode that blog entry or rode that book it's a cool you know what is your next step might be a generous somebody will sit down if you

go I don't know anything about works well okay so what do you want to do with it and obviously spend the time and wait forward some ideas so that you can then take that library has big questions Superstars somebody that basically can help you focus your goals on how to get to that next step and lastly a teammate one of the things I try to do whenever I join a company is finding team mates somebody that I can work with that I can help succeed and they'll help me succeed it makes all the difference two or three people community everybody in this community that is succeeding has a mentor everybody in this community that's succeeding has people they mentor

one of my mentors is Vint Cerf the father of the Internet okay conversations a couple times a year really fun but he gives me some insights that other people can go find these people in your life and then find people who can help through the period again we need a lot of great people in this it references haha so here are the national security training over 3,000 jobs are related and map specifically to these specialties they may be sands they may be local areas yes some of them are going to be for the some of they're going to be for free one note is the dirty little secret don't don't tell anybody don't say anything some training wall

here some volunteer work will pay for your hotel room okay Sam's has a program Isis word I stack up okay from those communities but also DEFCON black at the bigger conferences you can basically volunteer not just a great community but they're gonna pay for your hotel room in a pretty cool place savings so recognize now anybody okay other things anybody looking to know for masters or bachelors PhD double or quadruple PhD is written we're going to be living forever so we're going to need lots of phd's PHP so remember pay that bad back this is actually why one actually mentioned this disparate right here and this time but you in have been experience the same time so these are

places that you can do it and not you know put you in depth till your whole other things

thank you there's a really great resource for you today and they add to this all the time doing the network federal work a contractor I word if your state or local there's a good chance you get access to this right here okay that's pretty training that's paid for it and also other training based on your background pretty cool communities college does anybody know okay here's material here's a whole course on information assurance that has been published it's certified okay so please pass this on the professors in any University we want more people trained in this and this is free Oh including educator course max K through 12 did you notice all the little kids running around awesome aren't they so

for a long time we forgot about something when prices of conferences became anything from from $10 to $25 until they became 250 or 300 dollars or more black hat is now $2,500 or something like that that does include the hotel and everything else we forgot we lost the whole generation people the people running around the ones we're trying to build that community a lot of us participate and also contribute our time for that so for educators here's the classroom things do they have a cyber competitions for junior high and senior high which is pretty cool there's summer camps for velocity of the things we also have things like DEFCON we have the roots program besides we

have crypto kids we have we have the group we have here by the way this and he sees in my opinion besides DC are the best for kids they go away thinking wow I had these all these new ideas and things like truck in fact my my brothers are here and they and they are how many have lab oh sorry I did that already so labs these are great references for Security Letters and why do we do this have your virtualizations and labs ready you may end up having the weekend and you see some article published and you went redo it you want to try it you want to see if it works you wouldn't try

these software against it you want a pen test no forensics you want to see in taxes these are these are just a few I have dozens and dozens of you provide me you know email resources there are linked an update your LinkedIn your professional in this field your IT professional you're a security professional you want to get into roles this is a good reference for getting there your WordPress get WordPress for free and set up a professional blog in a few hours you're done write something make sure you have a URL you can include on your resume it's that easy conferences there are more conferences everything it's management these are the top 500 conferences and yes these are just the

these sites around the world the b-sides as of four weeks ago so I have no idea how many board and usually these are great okay and also the lens this link right here how many people their legs how many how many people can read the documentation how many people can can do something with it how many people think you can write a class okay seriously this will help you all of you to be able to write a class on okay this is great it's perfect and honestly as you could say yeah and honestly how many servers are using Unix Linux right now most those cloud services Microsoft and recognized a couple weeks ago the majority is Red Hat

just got bought her half hour half provides and Google's of Google's of dollars with lastly here's some of my references notice that most of them are go our hair on fire oh my god we don't have enough people take a look at this one right here the minute about the shortage this is what started me writing this because it meant that the story the this is we need to help you understand how to get the field and what you need to know concisely we have to help the people hiring understand the community wants to be hired and they're passionate about it otherwise you wouldn't be here on a Saturday but also that you're competent and ready to move on to that

and they should use some of the same terms to come out of this framework okay a job is something someone else controls and invest in your future that's what a job is careers something that you control your future and both parties and best they think about that that's what I hope free because honestly the first one is April and you go crazy and you leave jobs the second one is if you want to be a Mountie of her be active get out there don't sit just walk play xbox unless you're hacking the Xbox okay so I work for a company called miner the things I've seen in these logos or burning these things this is

what we do we basically have our mission driven teams were dedicated for solving problems here's a list of their code we make code available all the time so if anybody wants to try so our community is basically focused on fixing classes of problems and then making it public and yes we also support so these are things that we're passionate about and that's why I'm here today besides the riddle and if you're interested there's a bunch of jobs and about bachelor's degree this summer we have a vast bachelor's master's PhD you're preparing for that we actually have a new professionals program which is specifically for you to get lots of experience and training turn ships and all kind of fun things so

feel free contact negative got my email

otherwise do you have any questions more pictures [Music]

I stay inspired because I because something like this holy crap I could use that or I see presentation I want to learn something and honestly we are very in demand and very common so you know inspire and also there are several presentations on people like good enough to actually accomplish some of these things there are several presentations cos person number one is what's called the community is called Alan's I mean this community is pretty cool because we have this kind of stuff we discussed postures in German you also deal with the stresses with the job sometimes and how not to just go off the rails I don't know any other plus okay showing up and seeing something funny

like worse that we didn't show up see out there there was somebody running around with

so that's what keeps me motivated just the fun things are anybody else any questions seriously go back to that framework it will make it really simple but some of the baselines are to know Atlantic's cleanse is so important matter of fact make sure you take your vlog your your computer your laptop partition it at least if not make it whole Linux VM ware and with that other operating system okay use that because that's where where things are going learning programming language Python isn't language today that's easy not to learn that's impacting all of us in every part and then it becomes very dependent on we already want to go with your career those are two basements oh yes and being

comfortable and eventually get to mid range to stand up here tell stories

I'd be round here for us today so don't [Music]